Trusted boot-loader authentication

1. A method of boot-loading an electronic device, comprising:

boot-loading a trusted execution environment (TEE) in a trusted security zone of a processor of the electronic device, where the TEE boot-loads before a rich execution environment (REE) boot-loads;

launching a boot-loader authentication application by the TEE in the trusted security zone;

calculating a hash value of the REE boot-loader by analyzing instructions of the REE boot-loader one at a time, the hash value determined according to individual hashes of each analyzed instruction of the REE boot-loader;

comparing the hash value of the REE boot-loader by the boot-loader authentication application to a reference hash value of the REE boot-loader stored in the TEE;

determining a signature value of an operating system (OS) of the REE by the boot-loader authentication application over the instructions and data files of the OS;

comparing the signature value of the OS of the REE by the boot-loader authentication application to an authentication signature value of the OSS stored in the TEE; and

in response to the hash value of the REE boot-loader not matching the reference hash value or the signature value of the OS of the REE not matching the authentication signature value, taking action by the boot-loader authentication application.

2. The method of claim 1 , wherein taking action comprises the boot-loader authentication application preventing the REE boot-loader from executing on the electronic device.

3. The method of claim 1 , wherein taking action comprises the boot-loader authentication application overwriting the boot-loader in the REE with a trusted boot-loader.

4. The method of claim 1 , wherein the electronic device is an Internet of things (IoT) device.

5. The method of claim 1 , wherein the electronic device is one of a mobile phone, a smart phone, a wearable computer, a laptop computer, a tablet computer, or a notebook computer.

6. The method of claim 1 , wherein determining the signature value of the OS of the REE by the boot-loader authentication application comprises determining the signature value of the OS over the instructions of a kernel of the OS.

7. An electronic device, comprising:

a processor comprising a trusted execution environment (TEE) and a rich execution environment (REE);

a non-transitory memory;

an REE boot-loader stored in an REE portion of the non-transitory memory that, when executed in the REE of the processor, boot-loads the REE; and

a boot-loader authentication application stored in a TEE portion of the non-transitory memory that, when executed in the TEE of the processor,

calculates a hash value of the REE boot-loader by analyzing instructions of the REE boot-loader one at a time, the hash value determined according to individual hashes of each analyzed instruction of the REE boot-loader;

compares the hash value of the REE boot-loader to a reference hash value of the REE boot-loader stored in the TEE portion of the non-transitory memory; and

in response to the hash value of the REE boot-loader not matching the reference hash value, takes action.

8. The electronic device of claim 7 , wherein the electronic device is an Internet of things (IoT) device.

9. The electronic device of claim 7 , wherein the electronic device is one of a mobile phone, a smart phone, a wearable computer, a laptop computer, a tablet computer, or a notebook computer.

10. The electronic device of claim 7 , wherein the boot-loader authentication application determines the hash value of the REE boot-loader as a cyclic redundancy check (CRC) value.

11. The electronic device of claim 7 , wherein the boot-loader application further determines a signature value of a REE operating system kernel and compares the signature value of the REE operating system kernel to an authorization kernel signature value stored in the TEE portion of the non-transitory memory.

12. The electronic device of claim 7 , wherein the REE boot-loader is not executed in the REE until the boot-loader authentication application has completed execution.

13. A method of boot-loading an electronic device, comprising:

boot-loading a trusted execution environment (TEE) in a trusted security zone of a processor of the electronic device, where the TEE boot-loads before a rich execution environment (REE) boot-loads;

launching a boot-loader authentication application by the TEE in the trusted security zone;

calculating a hash value of the REE boot-loader by analyzing instructions of the REE boot-loader one at a time, the hash value determined according to individual hashes of each analyzed instruction of the REE boot-loader;

comparing the hash value of the REE boot-loader to a reference hash value of the REE boot-loader stored in the TEE; and

in response to the hash value of the REE boot-loader not matching the reference hash value, taking action by the boot-loader authentication application.

14. The method of claim 13 , wherein taking action comprises the boot-loader authentication application preventing the REE boot-loader from executing on the electronic device.

15. The method of claim 13 , wherein taking action comprises the boot-loader authentication application sending a message to a boot-loader authentication server, where the message reports the boot-loader authentication failure event.

16. The method of claim 13 , wherein the electronic device is an Internet of things (IoT) device.

17. The method of claim 13 , wherein the boot-loader authentication application determines the hash value as a cyclic redundancy check (CRC) value calculated over the instructions of the REE boot-loader.